def rule(event):
    if any(
        [
            all(
                [
                    "\\MSSE-" in event.deep_get("PipeName", default=""),
                    "-server" in event.deep_get("PipeName", default=""),
                ]
            ),
            event.deep_get("PipeName", default="").startswith("\\postex_"),
            event.deep_get("PipeName", default="").startswith("\\status_"),
            event.deep_get("PipeName", default="").startswith("\\msagent_"),
            event.deep_get("PipeName", default="").startswith("\\mojo_"),
            event.deep_get("PipeName", default="").startswith("\\interprocess_"),
            event.deep_get("PipeName", default="").startswith("\\samr_"),
            event.deep_get("PipeName", default="").startswith("\\netlogon_"),
            event.deep_get("PipeName", default="").startswith("\\srvsvc_"),
            event.deep_get("PipeName", default="").startswith("\\lsarpc_"),
            event.deep_get("PipeName", default="").startswith("\\wkssvc_"),
        ]
    ):
        return True
    return False
